@intentius/chant 0.41.20 → 0.42.1

package/src/terraform/parse.ts

@@ -10,12 +10,16 @@
 
 import { readdirSync, readFileSync } from "fs";
 import { join } from "path";
-import { buildGraph } from "./graph";
+import { buildGraph, collectExpressions, type ExpressionRefs } from "./graph";
 import { readStateInstanceCounts, applyStateCounts } from "./state";
 import type { Hcl2JsonTree, TfGraph } from "./types";
 
-/** Minimal shape of the parser export we depend on. */
-type Hcl2JsonParse = (filename: string, hcl: string) => Promise<Hcl2JsonTree>;
+/** Minimal shape of the parser exports we depend on. */
+export interface Hcl2Json {
+  parse: (filename: string, hcl: string) => Promise<Hcl2JsonTree>;
+  /** Expression-AST reference extraction (#998) — one traversal accessor per reference. */
+  getReferencesInExpression: (filename: string, expression: string) => Promise<Array<{ value: string }>>;
+}
 
 export class Hcl2JsonNotInstalled extends Error {
   constructor(cause: unknown) {
@@ -32,15 +36,38 @@ export class Hcl2JsonNotInstalled extends Error {
  * Lazy-load the optional HCL parser. Throws `Hcl2JsonNotInstalled` with an
  * install hint when the package is missing, rather than a raw MODULE_NOT_FOUND.
  */
-export async function loadHcl2json(): Promise<Hcl2JsonParse> {
+export async function loadHcl2json(): Promise<Hcl2Json> {
   try {
-    const mod = (await import("@cdktf/hcl2json")) as { parse: Hcl2JsonParse };
-    return mod.parse;
+    return (await import("@cdktf/hcl2json")) as Hcl2Json;
   } catch (err) {
     throw new Hcl2JsonNotInstalled(err);
   }
 }
 
+/**
+ * Resolve every interpolated string in the merged tree through the parser's
+ * expression AST (`getReferencesInExpression`), producing the accessor map
+ * `buildGraph` classifies. The AST — not a regex over the expression body —
+ * decides what is a reference, so a quoted address used as a map key or an
+ * escaped `$${...}` literal yields none. An expression the AST cannot parse in
+ * isolation resolves to no references (fewer edges, never a phantom one).
+ */
+async function resolveExpressionRefs(hcl2json: Hcl2Json, tree: Hcl2JsonTree): Promise<ExpressionRefs> {
+  const refs = new Map<string, string[]>();
+  for (const expr of collectExpressions(tree)) {
+    try {
+      const found = await hcl2json.getReferencesInExpression("expression.tf", expr);
+      refs.set(
+        expr,
+        found.map((r) => r.value),
+      );
+    } catch {
+      refs.set(expr, []);
+    }
+  }
+  return refs;
+}
+
 /** Deep-merge hcl2json trees across files (resource/module/data namespaces). */
 function mergeTrees(into: Hcl2JsonTree, next: Hcl2JsonTree): void {
   for (const section of ["resource", "data"] as const) {
@@ -74,14 +101,14 @@ export interface ParseTerraformOptions {
  * instance counts become accurate (see `state.ts`).
  */
 export async function parseTerraformDir(dir: string, opts: ParseTerraformOptions = {}): Promise<TfGraph> {
-  const parse = await loadHcl2json();
+  const hcl2json = await loadHcl2json();
   const files = listTfFiles(dir);
   const merged: Hcl2JsonTree = {};
   for (const file of files) {
-    const tree = await parse(file, readFileSync(file, "utf-8"));
+    const tree = await hcl2json.parse(file, readFileSync(file, "utf-8"));
     mergeTrees(merged, tree);
   }
-  const graph = buildGraph(merged);
+  const graph = buildGraph(merged, await resolveExpressionRefs(hcl2json, merged));
   if (opts.statePath) applyStateCounts(graph, readStateInstanceCounts(opts.statePath));
   return graph;
 }

package/src/terraform/score.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { scoreEstate, bandFor } from "./score";
 import type { Hcl2JsonTree } from "./types";
 
@@ -28,7 +28,7 @@ describe("scoreEstate — #197 worked examples", () => {
         },
       },
     };
-    const results = scoreEstate(buildGraph(tree));
+    const results = scoreEstate(buildFixtureGraph(tree));
     const map = byAddress(results);
 
     // The folded sub-resource is not ranked on its own.
@@ -51,7 +51,7 @@ describe("scoreEstate — #197 worked examples", () => {
         },
       },
     };
-    const results = scoreEstate(buildGraph(tree));
+    const results = scoreEstate(buildFixtureGraph(tree));
     const cdn = byAddress(results)["module.cdn"];
     expect(cdn.score).toBe(61); // 100 - 12*2 - 15*(2-1)
     expect(cdn.band).toBe("carvable w/ edits");
@@ -70,7 +70,7 @@ describe("scoreEstate — #197 worked examples", () => {
         aws_subnet: consumers,
       },
     };
-    const vpc = byAddress(scoreEstate(buildGraph(tree)))["aws_vpc.main"];
+    const vpc = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_vpc.main"];
     expect(vpc.score).toBe(0);
     expect(vpc.band).toBe("leave in Terraform");
     expect(vpc.breakdown.inbound).toBe(40);
@@ -82,7 +82,7 @@ describe("scoreEstate — penalties", () => {
     const tree: Hcl2JsonTree = {
       resource: { random_pet: { name: [{ length: 2 }] } },
     };
-    const r = scoreEstate(buildGraph(tree))[0];
+    const r = scoreEstate(buildFixtureGraph(tree))[0];
     expect(r.score).toBe(0);
     expect(r.breakdown.tier).toBeNull();
     expect(r.mapsTo).toBeUndefined();
@@ -97,7 +97,7 @@ describe("scoreEstate — penalties", () => {
         },
       },
     };
-    const map = byAddress(scoreEstate(buildGraph(tree)));
+    const map = byAddress(scoreEstate(buildFixtureGraph(tree)));
     expect(map["aws_sqs_queue.plain"].score).toBe(100); // tier1, no edges, no dynamic
     expect(map["aws_sqs_queue.fanned"].score).toBe(90); // -10 dynamic
   });
@@ -110,7 +110,7 @@ describe("scoreEstate — penalties", () => {
         aws_sqs_queue: { dlq: [{ name: "d", redrive: "${aws_sns_topic.alerts.arn}" }] },
       },
     };
-    const map = byAddress(scoreEstate(buildGraph(tree)));
+    const map = byAddress(scoreEstate(buildFixtureGraph(tree)));
     expect(map["aws_sqs_queue.dlq"].score).toBe(96); // 100 - 4*1 outbound
     expect(map["aws_sns_topic.alerts"].score).toBe(88); // 100 - 12*1 inbound
   });
@@ -123,7 +123,7 @@ describe("scoreEstate — penalties", () => {
         aws_sns_topic: { t: [{ name: "t" }] },
       },
     };
-    const scores = scoreEstate(buildGraph(tree)).map((r) => r.score);
+    const scores = scoreEstate(buildFixtureGraph(tree)).map((r) => r.score);
     expect(scores).toEqual([...scores].sort((a, b) => b - a));
   });
 });

package/src/terraform/state.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 import { readStateInstanceCounts, applyStateCounts } from "./state";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { scoreEstate } from "./score";
 import type { Hcl2JsonTree } from "./types";
 
@@ -44,7 +44,7 @@ describe("readStateInstanceCounts", () => {
 
 describe("applyStateCounts", () => {
   test("overlays counts; nodes absent from state keep 1", () => {
-    const graph = buildGraph({
+    const graph = buildFixtureGraph({
       resource: {
         aws_instance: { web: [{ count: 3, ami: "x" }] },
         aws_sqs_queue: { orphan: [{ name: "q" }] },
@@ -61,12 +61,12 @@ describe("applyStateCounts", () => {
       resource: { aws_sqs_queue: { fan: [{ count: 5, name: "q" }] } },
     };
     // Without state: instances=1, only the -10 dynamic penalty → 90.
-    const noState = scoreEstate(buildGraph(tree))[0];
+    const noState = scoreEstate(buildFixtureGraph(tree))[0];
     expect(noState.score).toBe(90);
     expect(noState.breakdown.instances).toBe(1);
 
     // With state: 5 instances → -10 dynamic -3*(5-1)=-12 → 78, drops out of "clean leaf".
-    const withCounts = buildGraph(tree);
+    const withCounts = buildFixtureGraph(tree);
     applyStateCounts(withCounts, new Map([["aws_sqs_queue.fan", 5]]));
     const stated = scoreEstate(withCounts)[0];
     expect(stated.breakdown.instances).toBe(5);

package/src/terraform/types.ts

@@ -48,6 +48,13 @@ export interface TfEdge {
   to: string;
   /** The attribute path(s) referenced, e.g. `["id", "arn"]`. */
   attrs: string[];
+  /**
+   * The referring block's own top-level attribute(s) the reference sits in,
+   * e.g. `["vpc_id"]` for a subnet reading its VPC (#998). This is what a
+   * deferred outbound input is named after when emit turns it into a build
+   * parameter. Empty when the reference came from a non-object block shape.
+   */
+  via: string[];
 }
 
 export interface TfGraph {

package/src/terraform/unified-diff.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import { execFileSync } from "child_process";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { newFileDiff, unifiedDiff } from "./unified-diff";
+
+const OLD = `resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+  environment {
+    variables = {
+      ASSETS_BUCKET = aws_s3_bucket.assets.bucket
+    }
+  }
+}
+`;
+const NEW = OLD.replace("aws_s3_bucket.assets.bucket", "data.aws_s3_bucket.assets.bucket");
+
+describe("unifiedDiff", () => {
+  test("identical inputs produce no diff", () => {
+    expect(unifiedDiff("main.tf", OLD, OLD)).toBe("");
+  });
+
+  test("a one-line rewrite yields one hunk with context and git headers", () => {
+    const patch = unifiedDiff("main.tf", OLD, NEW);
+    const lines = patch.split("\n");
+    expect(lines[0]).toBe("diff --git a/main.tf b/main.tf");
+    expect(lines[1]).toBe("--- a/main.tf");
+    expect(lines[2]).toBe("+++ b/main.tf");
+    expect(lines[3]).toBe("@@ -2,7 +2,7 @@");
+    expect(patch).toContain("-      ASSETS_BUCKET = aws_s3_bucket.assets.bucket");
+    expect(patch).toContain("+      ASSETS_BUCKET = data.aws_s3_bucket.assets.bucket");
+    // 3 context lines either side of the change.
+    expect(lines.filter((l) => l.startsWith(" "))).toHaveLength(6);
+  });
+
+  test("distant changes split into separate hunks; close ones join", () => {
+    const hunkHeaders = (patch: string) => patch.split("\n").filter((l) => l.startsWith("@@"));
+    const oldText = Array.from({ length: 20 }, (_, i) => `line ${i}`).join("\n") + "\n";
+    const twoFar = oldText.replace("line 2", "LINE 2").replace("line 17", "LINE 17");
+    expect(hunkHeaders(unifiedDiff("f.txt", oldText, twoFar))).toHaveLength(2);
+    const twoNear = oldText.replace("line 8", "LINE 8").replace("line 10", "LINE 10");
+    expect(hunkHeaders(unifiedDiff("f.txt", oldText, twoNear))).toHaveLength(1);
+  });
+
+  test("marks a missing trailing newline", () => {
+    const patch = unifiedDiff("f.txt", "a\nb\n", "a\nb2");
+    expect(patch).toContain("+b2\n\");
+  });
+
+  test("newFileDiff renders /dev/null → b/<path>", () => {
+    const patch = newFileDiff("ds.tf", 'data "aws_s3_bucket" "assets" {\n  bucket = "b"\n}\n');
+    expect(patch).toContain("new file mode 100644");
+    expect(patch).toContain("--- /dev/null");
+    expect(patch).toContain("+++ b/ds.tf");
+    expect(patch).toContain("@@ -0,0 +1,3 @@");
+  });
+
+  test("git apply accepts the combined patch and reproduces the new content", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-udiff-"));
+    try {
+      writeFileSync(join(dir, "main.tf"), OLD);
+      const patch = unifiedDiff("main.tf", OLD, NEW) + newFileDiff("ds.tf", 'data "x" "y" {}\n');
+      writeFileSync(join(dir, "bridge.patch"), patch);
+      try {
+        execFileSync("git", ["apply", "bridge.patch"], { cwd: dir });
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "ENOENT") return; // no git on this machine
+        throw err;
+      }
+      expect(readFileSync(join(dir, "main.tf"), "utf-8")).toBe(NEW);
+      expect(readFileSync(join(dir, "ds.tf"), "utf-8")).toBe('data "x" "y" {}\n');
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/terraform/unified-diff.ts

@@ -0,0 +1,146 @@
+/**
+ * Minimal unified-diff generator for the carve bridge patch (#998). Emits
+ * git-applyable hunks (`git apply`, or plain `patch -p1`) so the whole survivor
+ * edit — data sources plus rewired references — lands in one reviewable file.
+ * LCS-based; bridge inputs are hand-sized `.tf` files, so O(n·m) is fine.
+ */
+
+/** One file's diff, `a/<path>` → `b/<path>`, with git headers. Empty when unchanged. */
+export function unifiedDiff(path: string, oldText: string, newText: string, context = 3): string {
+  if (oldText === newText) return "";
+
+  const oldLines = splitLines(oldText);
+  const newLines = splitLines(newText);
+  const ops = diffOps(oldLines.lines, newLines.lines);
+  const hunks = buildHunks(ops, context);
+  if (hunks.length === 0) return "";
+
+  const L: string[] = [];
+  L.push(`diff --git a/${path} b/${path}`);
+  L.push(`--- a/${path}`);
+  L.push(`+++ b/${path}`);
+  for (const hunk of hunks) {
+    L.push(`@@ -${hunkRange(hunk.oldStart, hunk.oldCount)} +${hunkRange(hunk.newStart, hunk.newCount)} @@`);
+    for (const op of hunk.ops) {
+      L.push(`${op.kind === "add" ? "+" : op.kind === "del" ? "-" : " "}${op.line}`);
+      if (op.kind !== "add" && op.oldIndex === oldLines.lines.length - 1 && !oldLines.trailingNewline) {
+        L.push("\");
+      }
+      if (op.kind !== "del" && op.newIndex === newLines.lines.length - 1 && !newLines.trailingNewline) {
+        L.push("\");
+      }
+    }
+  }
+  return L.join("\n") + "\n";
+}
+
+/** A new-file diff (`/dev/null` → `b/<path>`), git-applyable. */
+export function newFileDiff(path: string, text: string): string {
+  const { lines, trailingNewline } = splitLines(text);
+  const L: string[] = [];
+  L.push(`diff --git a/${path} b/${path}`);
+  L.push("new file mode 100644");
+  L.push("--- /dev/null");
+  L.push(`+++ b/${path}`);
+  if (lines.length > 0) {
+    L.push(`@@ -0,0 +${hunkRange(1, lines.length)} @@`);
+    for (const line of lines) L.push(`+${line}`);
+    if (!trailingNewline) L.push("\");
+  }
+  return L.join("\n") + "\n";
+}
+
+function hunkRange(start: number, count: number): string {
+  return count === 1 ? String(start) : `${count === 0 ? start - 1 : start},${count}`;
+}
+
+function splitLines(text: string): { lines: string[]; trailingNewline: boolean } {
+  if (text === "") return { lines: [], trailingNewline: true };
+  const trailingNewline = text.endsWith("\n");
+  const lines = text.split("\n");
+  if (trailingNewline) lines.pop();
+  return { lines, trailingNewline };
+}
+
+interface DiffOp {
+  kind: "keep" | "del" | "add";
+  line: string;
+  /** Index in the old file (keep/del). */
+  oldIndex: number;
+  /** Index in the new file (keep/add). */
+  newIndex: number;
+}
+
+/** Line-level LCS diff as a flat op list. */
+function diffOps(a: string[], b: string[]): DiffOp[] {
+  const n = a.length;
+  const m = b.length;
+  // lcs[i][j] = LCS length of a[i..] and b[j..]
+  const lcs: number[][] = Array.from({ length: n + 1 }, () => new Array<number>(m + 1).fill(0));
+  for (let i = n - 1; i >= 0; i--) {
+    for (let j = m - 1; j >= 0; j--) {
+      lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+    }
+  }
+  const ops: DiffOp[] = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      ops.push({ kind: "keep", line: a[i], oldIndex: i, newIndex: j });
+      i++;
+      j++;
+    } else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+      ops.push({ kind: "del", line: a[i], oldIndex: i, newIndex: j });
+      i++;
+    } else {
+      ops.push({ kind: "add", line: b[j], oldIndex: i, newIndex: j });
+      j++;
+    }
+  }
+  for (; i < n; i++) ops.push({ kind: "del", line: a[i], oldIndex: i, newIndex: j });
+  for (; j < m; j++) ops.push({ kind: "add", line: b[j], oldIndex: i, newIndex: j });
+  return ops;
+}
+
+interface Hunk {
+  oldStart: number;
+  oldCount: number;
+  newStart: number;
+  newCount: number;
+  ops: DiffOp[];
+}
+
+/** Group change ops into hunks with `context` lines of surrounding keeps. */
+function buildHunks(ops: DiffOp[], context: number): Hunk[] {
+  const changed = ops.map((op) => op.kind !== "keep");
+  const include = new Array<boolean>(ops.length).fill(false);
+  for (let k = 0; k < ops.length; k++) {
+    if (!changed[k]) continue;
+    for (let c = Math.max(0, k - context); c <= Math.min(ops.length - 1, k + context); c++) {
+      include[c] = true;
+    }
+  }
+
+  const hunks: Hunk[] = [];
+  let k = 0;
+  while (k < ops.length) {
+    if (!include[k]) {
+      k++;
+      continue;
+    }
+    const start = k;
+    while (k < ops.length && include[k]) k++;
+    const slice = ops.slice(start, k);
+    const oldOps = slice.filter((op) => op.kind !== "add");
+    const newOps = slice.filter((op) => op.kind !== "del");
+    hunks.push({
+      oldStart: (oldOps[0]?.oldIndex ?? slice[0].oldIndex) + 1,
+      oldCount: oldOps.length,
+      newStart: (newOps[0]?.newIndex ?? slice[0].newIndex) + 1,
+      newCount: newOps.length,
+      ops: slice,
+    });
+  }
+  return hunks;
+}